Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[Security] Allow RememberMeHandler to use a custom RememberMeDetails class#44459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
tyrelcher wants to merge7 commits intosymfony:7.4
base:7.4
Choose a base branch
Loading
fromtyrelcher:rememberme-custom-cookie-format

Conversation

tyrelcher
Copy link

QA
Branch?6.1
Bug fix?no
New feature?yes
Deprecations?yes
TicketsFix#44168
LicenseMIT
Doc PR-

When writing a customRememberMeHandler it is not possible to change anything about what is stored in the cookie or how. Not every implementation would for example need to include the user class or identifier in the cookie or may not even want to. Maybe you might want to add some other value to it, in which case concatenating it to the$value parameter would seem like more of a dirty workaround.

This PR adds support for theRememberMeAuthenticator andRememberMeHandler to use a differentRememberMeDetails class when needed.

Currently I have not yet added an interface forRememberMeDetails to implement so it would be necessary to extend the class directly. This is because I'm thinking of making an RFC first for changing theRememberMeDetails implementation for the different available strategies.

thereisnobugs reacted with thumbs up emoji
@carsonbot
Copy link

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (seehttps://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
  • Features and deprecations must be submitted against the 6.1 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

Copy link
Member

@chalasrchalasr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Thanks for the PR. Here are some random comments. Don't forget to add tests 😉

@tyrelcher
Copy link
Author

I've added some tests. This includes 2 tests which test the deprecated code paths still work, but this does naturally result in self deprecation notices even when the tests succeed. Considering the PR checks seem to fail because of this it seems like the tests are not supposed to cause any of these.

As this is the first time I'm making a PR I'm not quite sure what the policy on tests like these are. Am I supposed to test these a different way, should deprecated code paths simply not be tested, or can these failures in this case be ignored?

@wouterj
Copy link
Member

As this is the first time I'm making a PR I'm not quite sure what the policy on tests like these are. Am I supposed to test these a different way, should deprecated code paths simply not be tested, or can these failures in this case be ignored?

These tests have to be in the legacy group (deprecations in legacy tests are ignored):

/** * @group legacy */public function testSomeDeprecatedBehavior(){}

In these legacy tests, you can also use theExpectDeprecationTrait to test that the deprecations are triggered correctly (docs).

Copy link
Member

@wouterjwouterj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Thanks for the PR - it's looking very complete for a first contribution!

I'm a bit unsure about thegetUserIdentifierForCookie() method and whether it should be moved to a separate interface. But as 99% of the remember me handlers extend fromAbstractRememberMeHandler, which has the default behavior, it's probably OK.

@fabpotfabpot modified the milestones:6.1,6.2May 20, 2022
@tyrelchertyrelcherforce-pushed therememberme-custom-cookie-format branch from9804417 to99b49d0CompareJune 6, 2022 08:56
@tyrelcher
Copy link
Author

I rebased the PR to 6.2 and solved the resulting merge conflicts. There are some failing tests, but it seems like those are unrelated to the changes of this PR.

No new feedback has come since the last feedback was implemented. Is there anything else needed from my side to get this merged?

@tyrelcher
Copy link
Author

@wouterj I'll wait for the 6.3 window and rebase, but is there anything I still need to do aside from that? Like I mentioned previously, all the feedback I got has already been implemented.

@nicolas-grekasnicolas-grekas removed this from the6.2 milestoneNov 5, 2022
@nicolas-grekasnicolas-grekas added this to the6.3 milestoneNov 5, 2022
@nicolas-grekasnicolas-grekas modified the milestones:6.3,6.4May 23, 2023
@nicolas-grekasnicolas-grekas modified the milestones:6.4,7.1Nov 15, 2023
@xabbuhxabbuh modified the milestones:7.1,7.2May 15, 2024
@fabpotfabpot modified the milestones:7.2,7.3Nov 20, 2024
@fabpotfabpot modified the milestones:7.3,7.4May 26, 2025
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@wouterjwouterjwouterj left review comments

@chalasrchalasrAwaiting requested review from chalasrchalasr is a code owner

Assignees
No one assigned
Projects
None yet
Milestone
7.4
Development

Successfully merging this pull request may close these issues.

[Security] [Remember Me] Improved flexibility for remember me cookies
7 participants
@tyrelcher@carsonbot@wouterj@chalasr@fabpot@nicolas-grekas@xabbuh

[8]ページ先頭

©2009-2025 Movatter.jp